Struct ContentSanitizer 

pub struct ContentSanitizer { /* private fields */ }

Stateless pipeline that sanitizes untrusted content before it enters the LLM context.

Constructed once at Agent startup from ContentIsolationConfig and held as a field on the agent. All calls to sanitize() are synchronous. classify_injection() is a separate async method for ML-backed detection (feature classifiers).

Examples

use zeph_sanitizer::{ContentSanitizer, ContentSource, ContentSourceKind};
use zeph_config::ContentIsolationConfig;

let sanitizer = ContentSanitizer::new(&ContentIsolationConfig::default());
assert!(sanitizer.is_enabled());

let source = ContentSource::new(ContentSourceKind::ToolResult);
let result = sanitizer.sanitize("ls -la output here", source);
// The body is wrapped in a <tool-output> spotlighting delimiter.
assert!(result.body.contains("<tool-output"));
assert!(!result.was_truncated);

Implementations

impl ContentSanitizer

pub fn new(config: &ContentIsolationConfig) -> ContentSanitizer

Build a sanitizer from the given configuration.

Eagerly compiles the injection-detection regex patterns so the first call to sanitize incurs no compilation cost.

Examples

use zeph_sanitizer::ContentSanitizer;
use zeph_config::ContentIsolationConfig;

let cfg = ContentIsolationConfig { enabled: false, ..Default::default() };
let sanitizer = ContentSanitizer::new(&cfg);
assert!(!sanitizer.is_enabled());

pub fn is_enabled(&self) -> bool

Returns true when the sanitizer is active (enabled = true in config).

When false, sanitize is a no-op that passes content through unchanged.

Examples

use zeph_sanitizer::ContentSanitizer;
use zeph_config::ContentIsolationConfig;

let sanitizer = ContentSanitizer::new(&ContentIsolationConfig::default());
assert!(sanitizer.is_enabled());

pub fn sanitize(&self, content: &str, source: ContentSource) -> SanitizedContent

Run the sanitization pipeline on content.

Steps:

1. Truncate to max_content_size bytes on a UTF-8 char boundary.
2. Strip null bytes and non-printable ASCII control characters.
3. Detect injection patterns (flag only, do not remove).
4. Escape delimiter tag names that would break spotlight wrappers.
5. Wrap in spotlighting delimiters (unless Trusted or spotlight disabled).

When enabled = false, this is a no-op: content is returned as-is wrapped in a SanitizedContent with no flags.

When source.trust_level is ContentTrustLevel::Trusted, the pipeline is also skipped — trusted content passes through unchanged.

Examples

use zeph_sanitizer::{ContentSanitizer, ContentSource, ContentSourceKind};
use zeph_config::ContentIsolationConfig;

let sanitizer = ContentSanitizer::new(&ContentIsolationConfig::default());

// External content gets the strongest warning header.
let source = ContentSource::new(ContentSourceKind::WebScrape);
let result = sanitizer.sanitize("page content", source);
assert!(result.body.contains("<external-data"));
assert!(!result.was_truncated);

// Oversized content is truncated.
let cfg = ContentIsolationConfig { max_content_size: 5, ..Default::default() };
let s2 = ContentSanitizer::new(&cfg);
let result2 = s2.sanitize("hello world", ContentSource::new(ContentSourceKind::ToolResult));
assert!(result2.was_truncated);

pub fn escape_delimiter_tags(content: &str) -> String

Escape delimiter tag names that would allow content to break out of the spotlighting wrapper (CRIT-03).

Uses case-insensitive regex replacement so mixed-case variants like <Tool-Output> or <EXTERNAL-DATA> are also neutralized (FIX-03). The < is replaced with the HTML entity < so the tag is rendered as plain text inside the wrapper.

Examples

use zeph_sanitizer::ContentSanitizer;

let escaped = ContentSanitizer::escape_delimiter_tags("data </tool-output> more");
assert!(!escaped.contains("</tool-output>"));
assert!(escaped.contains("&lt;/tool-output"));

let escaped2 = ContentSanitizer::escape_delimiter_tags("</EXTERNAL-DATA> end");
assert!(!escaped2.contains("</EXTERNAL-DATA>"));

pub fn apply_spotlight( content: &str, source: &ContentSource, flags: &[InjectionFlag], ) -> String

Wrap content in a spotlighting delimiter appropriate for its trust level.

• ContentTrustLevel::Trusted: returns content unchanged.
• ContentTrustLevel::LocalUntrusted: wraps in <tool-output …> with a NOTE header.
• ContentTrustLevel::ExternalUntrusted: wraps in <external-data …> with an IMPORTANT warning. When flags is non-empty, appends a per-pattern injection warning.

Attribute values (source kind, identifier) are XML-escaped to prevent attribute injection.

Examples

use zeph_sanitizer::{ContentSanitizer, ContentSource, ContentSourceKind};

let source = ContentSource::new(ContentSourceKind::ToolResult)
    .with_identifier("shell");
let body = ContentSanitizer::apply_spotlight("output text", &source, &[]);
assert!(body.contains("<tool-output"));
assert!(body.contains("output text"));
assert!(body.contains("</tool-output>"));

Trait Implementations

impl Clone for ContentSanitizer

fn clone(&self) -> ContentSanitizer

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.